Resources / Regulation Maps / Financial Services
Regulation MapsFinancial ServicesCredit Unions and Lenders
AI Regulation Map for Credit Unions
The federal and state laws that apply when credit unions use AI in lending, fraud detection, member service, and marketing, and what each requires.
The short answer
Credit unions using AI work within the same laws that already govern lending, member data, and fair treatment. The rules that matter most are the Equal Credit Opportunity Act and Regulation B for credit decisions, the Fair Credit Reporting Act for consumer report data, the Gramm-Leach-Bliley Act and NCUA’s security program rule for member information, the Bank Secrecy Act for transaction monitoring, and Regulation E for electronic fund transfer disputes. Colorado’s revised AI law adds disclosure duties for automated decisions beginning January 1, 2027.
At a glance
Which laws apply to which AI uses
| AI use | Reg B | FCRA | GLBA and Part 748 | BSA and AML | Reg E | Unfair practices | Colorado |
|---|---|---|---|---|---|---|---|
| Loan underwriting model | Primary | Primary | Applies | Not applicable | Not applicable | Applies | Primary |
| Fraud and AML monitoring | Not applicable | Not applicable | Applies | Primary | Applies | Applies | Not applicable |
| Member service chatbot | Not applicable | Not applicable | Primary | Not applicable | Primary | Primary | Not applicable |
| AI-written marketing | Applies | Not applicable | Applies | Not applicable | Not applicable | Primary | Not applicable |
| Staff drafting tools | Not applicable | Not applicable | Primary | Not applicable | Not applicable | Not applicable | Not applicable |
Primary lawAlso appliesGenerally not relevant
Laws that apply to AI at credit unions
| Law | What it covers | Where AI is affected | What to do |
|---|---|---|---|
| Equal Credit Opportunity Act and Regulation B | Fair lending and adverse action notices | AI underwriting and credit decision models | Be able to give specific, accurate reasons for every denial, and test models for discriminatory effects on protected groups. |
| Fair Credit Reporting Act | Use of consumer report information | Models that use credit reports or other consumer report data | Confirm permissible purpose, keep data accurate, and send the required notices when report data contributes to a denial. |
| Gramm-Leach-Bliley Act and NCUA Part 748 | Member privacy and the information security program | Chatbots, AI vendors, and any tool that receives member data | Bring AI tools and vendors into your security program and vendor oversight, and limit the member data shared with them. |
| Bank Secrecy Act and anti-money laundering rules | Transaction monitoring and suspicious activity reporting | AI fraud and AML models | Document how models work, validate them, and keep people reviewing alerts before decisions are made. |
| Regulation E | Electronic fund transfer errors and disputes | AI chatbots handling member questions | Make sure chatbots recognize error claims and route them so investigation deadlines are met. |
| Unfair or deceptive practices law | Accuracy and fairness in member-facing practices | Chatbots, automated servicing, and AI-written marketing | Check that AI tools give accurate information and that members can reach a person. Credit unions over $10 billion in assets are also examined by the CFPB. |
| Colorado SB 26-189 | Automated decision-making technology in consequential decisions | Lending and account decisions for Colorado members | Prepare disclosures and post-decision explanations before the law takes effect January 1, 2027. The Colorado attorney general enforces it. |
Common AI uses and their risk level
| AI use | Typical risk | Why |
|---|---|---|
| Loan underwriting or pricing model | High | Directly affects credit decisions and fair lending exposure. |
| Fraud and AML monitoring | Medium | Errors can freeze accounts or miss reportable activity. |
| Member service chatbot | Medium | Handles member data and must route disputes and complaints correctly. |
| Staff drafting and research tools | Low to medium | Low risk unless staff enter member data into unapproved tools. |
| Marketing content generation | Low | Accuracy and advertising rules still apply to the final content. |
Five steps to get ahead of it
Inventory
List every AI tool and model in use, including AI features inside your core, loan origination, and contact center systems.
Classify
Rate each use by risk, starting with anything that touches credit decisions or member accounts.
Review vendors
Check vendor contracts for data use, model training on member data, security, and audit rights.
Test credit models
Confirm you can explain adverse actions and test for discriminatory effects before and after deployment.
Report to the board
Give the board a regular summary of AI uses, risks, and controls.
Frequently asked questions
Can a credit union use AI to approve or deny loans?
Yes, but fair lending law applies in full. Under Regulation B, a denial must come with specific reasons, so the credit union must be able to explain what drove the model’s decision and should test the model for discriminatory effects.
Do credit unions have to tell members they are talking to a chatbot?
No single federal rule requires it today, but some states have disclosure rules for certain AI interactions, and Colorado’s revised law adds disclosure duties for automated decisions. Disclosing that a chatbot is AI, and offering a path to a person, is the safer practice.
How does NCUA examine AI?
NCUA applies its existing rules to AI, including information security program requirements, third-party vendor oversight, and consumer compliance. AI tools should be documented and governed like any other system that touches member data.
More Guides for Credit Unions and Lenders
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Governance Blueprint for Credit Unions
- AI Training Guide for Credit Unions
- AI Impact Assessment Example for Credit Unions
- AI Incident Response Playbook for Credit Unions
- AI Board Oversight Guide for Credit Unions
- Privacy Program Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- State AI Law Tracker for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
- AI Tabletop Exercise Scenario for Credit Unions
Sources
- Equal Credit Opportunity Act, 15 U.S.C. 1691, and Regulation B, 12 CFR Part 1002, including 12 CFR 1002.9 on adverse action notices
- Fair Credit Reporting Act, 15 U.S.C. 1681
- Gramm-Leach-Bliley Act, 15 U.S.C. 6801, and NCUA security program rule, 12 CFR Part 748
- Bank Secrecy Act, 31 U.S.C. 5311
- Electronic Fund Transfer Act and Regulation E, 12 CFR Part 1005
- Colorado SB 26-189, signed May 14, 2026, effective January 1, 2027
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Regulation Map for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-regulation-map-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
AI Governance Readiness Assessment
A gap analysis of your AI governance against the NIST AI RMF, with a prioritized plan for what to fix first.
AI Acceptable Use Policy
A clear, written policy that tells your people which AI tools they can use, for what work, and with what data.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.